Dark Storm Team Expands DDoS-for-Hire Operations, Demands Extortion Payments
The Dark Storm Team, a DDoS-for-hire group, is evolving its operations by directly extorting targets for cryptocurrency, demanding $5,000 to cease an alleged attack on the Amino social app.
The Dark Storm Team, a group known for offering distributed denial-of-service (DDoS) for hire, is reportedly expanding its operations to include direct extortion. The group has demanded $5,000 in cryptocurrency to stop an alleged DDoS attack targeting the Amino social app. This marks a shift from merely providing attack services to customers to actively using alleged attacks for direct financial gain from victims.
First observed in late 2023, Dark Storm gained notoriety after claiming responsibility for an outage affecting X (formerly Twitter) in March 2025. Since then, the group has claimed responsibility for attacks against various targets, including government websites, banks, and airports. However, independent verification of the extent and impact of these claimed attacks remains limited. Researchers from StealthMole have been tracking the group's activities, particularly through its presence on Telegram, identifying its commercial operations and its use of the persona 'GLITCH' for sales and communication.
The extortion attempt against Amino, with a demand of $5,000 in cryptocurrency, was first posted on October 19, 2025, with a formal attack claim following on October 22. The group reportedly returned to targeting Amino in October 2026. While the report does not confirm if Amino paid the ransom or independently verify the claimed disruption, this tactic represents a significant evolution in the group's modus operandi, moving beyond a service provider to an active extortionist.
Beyond direct extortion, Dark Storm continues to offer its core DDoS-for-hire services. A frequently reposted price list details various service durations, with three hours of DDoS activity costing $20, eight hours for $50, a full day for $100, a week for $350, and a month for $600. Cryptocurrency is the sole accepted payment method. The group also advertises other illicit services, including access to social media accounts starting at $250 and website database dumps from $300, with prices varying across different promotional menus.
Researchers have linked Dark Storm's commercial activities through persistent Telegram user IDs associated with the 'GLITCH' persona, allowing them to track the operation despite the group's attempts to rebrand or change account names. This continuity provides a stronger link between different sales handles than matching display names alone. The group has demonstrated resilience against platform bans, with replacement channels frequently appearing on Telegram throughout 2025 and 2026, often with the assistance of allied hacktivist groups.
Dark Storm has been observed collaborating with other hacktivist entities, notably Team1914 and NoName057(16). Evidence suggests reciprocal promotion and shared attack claims with Team1914, while Dark Storm has also forwarded posts from NoName057(16) and adopted their campaign tags. However, researchers caution that shared targets, forwarded messages, and overlapping hashtags do not definitively prove operational partnerships or shared infrastructure.
The underlying attack infrastructure used by Dark Storm remains largely unresolved. Many of their attack claims rely on availability reports from services like Check-Host, which can indicate whether a website is reachable but do not confirm the cause of any access failures. Geographic restrictions, unrelated outages, or defensive filtering by target networks could all produce similar results, making it difficult to definitively attribute disruptions solely to Dark Storm's actions.
The group's continued operation and evolving tactics highlight the persistent threat posed by DDoS-for-hire services and the increasing trend of these groups engaging in direct extortion. The lack of independent verification for many of their claims underscores the importance of critical assessment when evaluating threat actor pronouncements.